Mercurial > pidgin3 / file diff

--- a/libpurple/protocols/msn/msg.c	Mon Jan 27 17:34:21 2014 +0530
+++ b/libpurple/protocols/msn/msg.c	Wed Jan 29 00:28:08 2014 +0530
@@ -178,6 +178,8 @@
 		g_free(tmp_base);
 		g_return_if_reached();
 	}
+
+	/* NUL-terminate the end of the headers - it'll get skipped over below */
 	*end = '\0';
 
 	/* Split the headers and parse each one */
@@ -195,10 +197,12 @@
 
 			/* The only one I care about is 'boundary' (which is folded from
 			   the key 'Content-Type'), so only process that. */
-			if (!strcmp(key, "boundary")) {
+			if (!strcmp(key, "boundary") && value) {
 				char *end = strchr(value, '\"');
-				*end = '\0';
-				msn_message_set_header(msg, key, value);
+				if (end) {
+					*end = '\0';
+					msn_message_set_header(msg, key, value);
+				}
 			}
 
 			g_strfreev(tokens);
@@ -210,18 +214,15 @@
 		key = tokens[0];
 		value = tokens[1];
 
-		/*if not MIME content ,then return*/
 		if (!strcmp(key, "MIME-Version"))
 		{
-			g_strfreev(tokens);
-			continue;
+			/* Ignore MIME-Version header */
 		}
-
-		if (!strcmp(key, "Content-Type"))
+		else if (!strcmp(key, "Content-Type"))
 		{
 			char *charset, *c;
 
-			if ((c = strchr(value, ';')) != NULL)
+			if (value && (c = strchr(value, ';')) != NULL)
 			{
 				if ((charset = strchr(c, '=')) != NULL)
 				{
@@ -365,11 +366,12 @@
 		n += strlen(n);
 	}
 
-	n += g_strlcpy(n, "\r\n", end - n);
+	if ((end - n) > 2)
+		n += g_strlcpy(n, "\r\n", end - n);
 
 	body = msn_message_get_bin_data(msg, &body_len);
 
-	if (body != NULL)
+	if (body != NULL && (size_t)(end - n) > body_len)
 	{
 		memcpy(n, body, body_len);
 		n += body_len;